@arbium/enterprise-agent-connect 0.1.1 → 0.1.2-dev.75145ef

package/README.md

@@ -5,17 +5,27 @@ grant it. Agents reach the apps through one MCP endpoint; every call is checked
 agent's grants and written to an audit log. Agents never hold the apps' credentials.
 
 - **Built-in apps:** Jira, Microsoft 365 (Outlook mail and calendar, SharePoint files and Excel,
-  Teams, Entra ID, Intune), Salesforce, FedEx, Dell TechDirect.
-- **Your own apps without code:** describe an internal REST API in one `connector.json`
-  ([docs/http-connector.md](docs/http-connector.md)).
+  Teams, Entra ID, Intune, Dynamics 365), Jamf Pro, Okta, Slack, Salesforce, Gong, SAP S/4HANA,
+  Oracle NetSuite, ServiceNow, Workday, FedEx, Dell TechDirect.
+- **Your own apps without code:** describe an internal REST API or a SaaS app's in one
+  `connector.json`, or draft one from its OpenAPI spec
+  ([docs/http-connector.md](docs/http-connector.md)); a SOAP service
+  ([docs/soap-connector.md](docs/soap-connector.md)) or an OData service such as SAP S/4HANA,
+  Dynamics 365 or SuccessFactors ([docs/odata-connector.md](docs/odata-connector.md)), drafted
+  from its WSDL or `$metadata`; or a database (PostgreSQL, SQL Server, MySQL, MariaDB, Oracle)
+  as named queries ([docs/sql-connector.md](docs/sql-connector.md)).
 - **Per-agent access:** tick what each agent can do per app, and limit it to values (mailboxes,
   sites, projects, customers). Anything that deletes needs an explicit confirmation.
+- **Agents started by app events:** a Jira issue created or updated starts the agents you choose,
+  each within its own limits, by webhook or by polling apps that cannot send one
+  ([docs/triggers.md](docs/triggers.md)).
 - **Self-hosted:** one Node service and Postgres. No UI ships; the admin API
   (`packages/server/openapi.json`) and the typed client (`packages/client`) are for building
   your own admin pages.
 
 How it is secured: [docs/security.md](docs/security.md). Adding apps:
-[docs/connectors.md](docs/connectors.md).
+[docs/connectors.md](docs/connectors.md). Running it next to internal systems (your own
+certificate authority, a proxy in front): [docs/inside-your-network.md](docs/inside-your-network.md).
 
 ## Quick start (about 10 minutes)
 
@@ -81,27 +91,169 @@ delete the database too).
 **Going further:** connect a real app from `GET /agent-connect/admin/v1/connectors` (each one
 lists its setup steps, as click paths and as commands), add your own app
 ([docs/http-connector.md](docs/http-connector.md)), or embed the service in your own Node app
-with `createAgentConnect({...})` from the server package (`npm install
-@arbium/enterprise-agent-connect`; the typed admin client is `@arbium/enterprise-agent-connect-client`).
+(below).
 
-Only `/agent-connect/mcp` and `/agent-connect/teams` may be public. The admin API refuses any
+Only `/agent-connect/mcp`, `/agent-connect/teams` and `/agent-connect/events` may be public. The admin API refuses any
 request that carries `X-Forwarded-For`, so never route it through a public load balancer.
 
+## Use it in your code
+
+```sh
+npm install @arbium/enterprise-agent-connect @arbium/enterprise-agent-connect-client
+```
+
+Both packages ship TypeScript types. Every snippet here is run by `scripts/consumer-test.sh`
+(full files: `scripts/consumer/`) against the packed packages, in CI.
+
+**Embed the service.** One instance per process, in a module of its own:
+
+```ts
+import { builtinConnectors, createAgentConnect } from "@arbium/enterprise-agent-connect";
+
+export const eac = await createAgentConnect({
+  database: { url: process.env.DATABASE_URL! }, // or a postgres.js instance
+  encryptionKey: process.env.CONNECT_ENCRYPTION_KEY!,
+  adminToken: process.env.AGENT_CONNECT_ADMIN_TOKEN!,
+  connectors: [...builtinConnectors, orders, inventory], // default: every built-in app
+});
+eac.start(); // the Teams and app event workers; await eac.stop() on shutdown
+```
+
+`connectors` is the list of apps this deployment offers. Leave it out for every built-in app;
+pass `builtinConnectors.filter((c) => ["jira", "fedex"].includes(c.id))` for only some.
+
+`eac.fetch` is a plain `(Request) => Promise<Response>` serving `/agent-connect/*`. Mount it at
+that path, before any body parser (Express and plain Node use `@hono/node-server`):
+
+```ts
+// Hono
+app.all("/agent-connect/*", (c) => eac.fetch(c.req.raw));
+
+// Express 5
+import { getRequestListener } from "@hono/node-server";
+app.all("/agent-connect/*splat", getRequestListener(eac.fetch));
+
+// Next.js: app/agent-connect/[...path]/route.ts (Node runtime)
+const handler = (req: Request) => eac.fetch(req);
+export { handler as GET, handler as POST, handler as PUT, handler as PATCH, handler as DELETE };
+
+// Plain Node
+import { serve } from "@hono/node-server";
+serve({ fetch: eac.fetch, port: 3000 });
+```
+
+**The typed admin client.** The admin API refuses requests that came through a load balancer
+(`X-Forwarded-For`), so call it from your server, over the network or in the same process
+(behind a proxy: [docs/inside-your-network.md](docs/inside-your-network.md)):
+
+```ts
+import { createClient } from "@arbium/enterprise-agent-connect-client";
+
+const admin = createClient({ baseUrl: "http://localhost:3000", token: process.env.AGENT_CONNECT_ADMIN_TOKEN! });
+// In the same process as eac, with no network hop:
+// createClient({ baseUrl: "http://agent-connect", token, fetch: (input, init) => eac.fetch(new Request(input, init)) })
+
+const org = await admin.organizations.create("Example Org");
+await admin.connect(org.id, "orders", {
+  capabilities: ["read"],
+  fields: { api_key: "example-key" },
+  connectedBy: "Example Admin",
+});
+const { agent, key } = await admin.createAgent(org.id, { name: "demo", createdBy: "Example Admin" });
+await admin.setGrant(org.id, agent.id, "orders", ["read"], { customers: ["acme"] }, "Example Admin");
+const rows = await admin.audit(org.id, { agent: agent.id });
+```
+
+**Your own app, no code.** Pass a connector definition with an `http` block
+([docs/http-connector.md](docs/http-connector.md)), or a `soap` or `odata` block, straight into
+`connectors`. It is checked like
+a `connector.json`; the type is `ConnectorJson`:
+
+```ts
+import type { ConnectorJson } from "@arbium/enterprise-agent-connect";
+
+const orders: ConnectorJson = {
+  id: "orders",
+  name: "Orders",
+  // ...setup steps, fields, capabilities, limits and verify, as in a connector.json
+  http: {
+    baseUrl: "https://orders.internal.example.com/api",
+    auth: { type: "header", header: "X-Api-Key", value: "api_key" },
+    tools: [{ name: "orders_get", description: "Read one order by its id.", method: "GET", path: "/orders/{id}",
+      params: { id: { type: "string", description: "The order id", in: "path" } } }],
+  },
+};
+```
+
+**Your own app, as code.** Build a `ConnectorModule` on the connector kit and give it its
+definition as `connector` ([docs/connectors.md](docs/connectors.md)). `create` gets a
+`ConnectorContext`, `{ connector }`: the definition parsed, with the branding filled in.
+
+```ts
+import { z } from "zod";
+import { audited, Denied, json, listLimit, type ConnectorModule } from "@arbium/enterprise-agent-connect/kit";
+
+const inventory: ConnectorModule = {
+  id: "inventory",
+  connector: { id: "inventory", /* ...the rest of its connector.json */ },
+  create: () => ({
+    vendor: { connect: async (fields) => ({ ... }), call: async (connection, request) => ({ ... }) },
+    toolset: {
+      names: ["inventory_get_stock"],
+      register(server, ctx, allowed) {
+        if (allowed.has("inventory_get_stock"))
+          server.registerTool("inventory_get_stock",
+            { description: "How many of one item are in stock.", inputSchema: z.object({ sku: z.string() }) },
+            ({ sku }) => audited(ctx, "inventory_get_stock", sku, async (mark) => {
+              const skus = listLimit(ctx.limits, "skus");
+              if (skus && !skus.includes(sku)) throw new Denied(`This agent may not read ${sku}`);
+              const res = await ctx.call({ method: "GET", path: `/stock/${encodeURIComponent(sku)}` });
+              mark(res.status);
+              return json(res.data);
+            }));
+      },
+    },
+  }),
+};
+```
+
+**Connect an agent.** Each agent uses its own key (`key` above) on one MCP endpoint,
+`<your origin>/agent-connect/mcp`:
+
+- Claude Code: `claude mcp add --transport http agent-connect https://agents.example.com/agent-connect/mcp --header "Authorization: Bearer $KEY"`
+- The Claude API's MCP connector (beta `mcp-client-2025-11-20`): `mcp_servers: [{ type: "url", url: "https://agents.example.com/agent-connect/mcp", name: "agent-connect", authorization_token: key }]` with `tools: [{ type: "mcp_toolset", mcp_server_name: "agent-connect" }]`. The endpoint must be reachable from the internet.
+- Claude Managed Agents: a vault `static_bearer` credential holding the key, keyed on the same URL.
+- Any MCP client over Streamable HTTP: `Authorization: Bearer <key>`; the quick start's `curl` shows the raw call.
+
 ## Kubernetes
 
-`deploy/helm/agent-connect` is a small chart: one replica (Teams run limits are counted in one
-process), a Service, and an optional Ingress with only the public paths. It needs the image
+To offer only some built-in apps, set `BUILTIN_APPS` to their ids, comma-separated (for example
+`jira,servicenow,sap-s4hana`; `GET /agent-connect/admin/v1/connectors` lists every id). Unset, every
+built-in app is offered. Apps you add with `CONNECTOR_DIRS` are always offered.
+
+`deploy/helm/agent-connect` is a small chart: one replica (Teams and app event run limits are
+counted in one process), a Service, and an optional Ingress with only the public paths. It needs the image
 (`image.repository`, `image.tag`; releases are `ghcr.io/try-caret/enterprise-agent-connect:<version>`) and a Secret with `DATABASE_URL`, `CONNECT_ENCRYPTION_KEY`
-and `AGENT_CONNECT_ADMIN_TOKEN` (`existingSecret`).
+and `AGENT_CONNECT_ADMIN_TOKEN` (`existingSecret`). For apps whose certificates your own
+authority signed, name a ConfigMap or Secret holding its bundle in `caBundle`
+([docs/inside-your-network.md](docs/inside-your-network.md)).
 
 ## Layout
 
-- `packages/server`: the service (HTTP, admin API, MCP, Teams, store, migrations) and its tests
+- `packages/server`: the service (HTTP, admin API, MCP, Teams, app events, store,
+  migrations) and its tests
 - `packages/connector-kit`: what a connector builds on (schemas, tool helpers, vendor types)
 - `packages/client`: typed admin API client
 - `connectors/<app>`: one folder per app: `connector.json`, `index.ts`, `tools.ts`, `vendor.ts`
-- `connectors/http`: runs any app described only in its `connector.json` (docs/http-connector.md)
+- `connectors/http`, `connectors/soap`, `connectors/odata`, `connectors/sql`: run any app
+  described only in its `connector.json` (docs/http-connector.md, docs/soap-connector.md,
+  docs/odata-connector.md, docs/sql-connector.md)
 - `examples/internal-app`: a small internal API and its connector, for the quick start
+- `scripts/openapi-to-connector.ts`: drafts an http connector from an OpenAPI 3.x spec
+- `examples/legacy-apps`: a SOAP and an SAP OData connector, described only in JSON
+- `scripts/wsdl-to-connector.ts`, `scripts/odata-to-connector.ts`: draft a connector from a WSDL
+  or an OData `$metadata`
+- `examples/legacy-orders`: a small orders database and its connector
 - `deploy/docker`, `deploy/helm`: image, Compose file and chart
 
 ## License

package/dist/connectors/dell-techdirect/index.d.ts

@@ -0,0 +1,8 @@
+declare const _default: {
+    id: string;
+    create: () => {
+        vendor: import("../../packages/connector-kit/src/types.js").Vendor;
+        toolset: import("../../packages/connector-kit/src/common.js").Toolset;
+    };
+};
+export default _default;

package/dist/connectors/dell-techdirect/tools.d.ts

@@ -0,0 +1,2 @@
+import { type Toolset } from "../../packages/connector-kit/src/common.js";
+export declare const dellTools: Toolset;

package/dist/connectors/dell-techdirect/vendor.d.ts

@@ -0,0 +1,6 @@
+import { type Fetch, type Vendor } from "../../packages/connector-kit/src/types.js";
+export declare const DELL_API = "https://apigtwb2c.us.dell.com";
+export declare const DELL_TOKEN_URL = "https://apigtwb2c.us.dell.com/auth/oauth/v2/token";
+export declare const ENTITLEMENTS_PATH = "/PROD/sbil/eapi/v5/asset-entitlements";
+export declare const PROBE_SERVICE_TAG = "0000000";
+export declare function dellVendor(fetchImpl?: Fetch): Vendor;

package/dist/connectors/dynamics-365/connector.json

@@ -0,0 +1,228 @@
+{
+  "id": "dynamics-365",
+  "name": "Dynamics 365",
+  "description": "Let agents work with your Dynamics 365 customers, opportunities and cases: find and update accounts and contacts, close opportunities, resolve cases, add notes, tasks and phone calls, and read other tables you list.",
+  "logo": "/brand/registry/dynamics-365.svg",
+  "identity": "Your Microsoft app registration, through the Microsoft connection, added to one Dynamics 365 environment as an application user. It reaches only what its security role allows. Each API key can be kept to records of chosen business units or teams.",
+  "provider": "microsoft",
+  "order": 8,
+  "accountKey": "environment",
+  "connectionKind": "guided",
+  "scopes": ["prvReadUser"],
+  "setup": [
+    {
+      "title": "Create a security role for agents",
+      "body": "In your Dynamics 365 environment, create a role that gives only what agents need: {scopes}. Each is a privilege on a table, for example prvReadAccount is Read on Account and prvCreateActivity is Create on Activity. Choose Organization access to let agents reach every record, or Business Unit to keep them to one business unit. You can keep each agent to some business units or teams here later.",
+      "link": {
+        "label": "Open Power Platform admin center",
+        "href": "https://admin.powerplatform.microsoft.com/environments"
+      },
+      "click": [
+        "In the Power Platform admin center, go to Manage, then Environments, and open your environment.",
+        "Select Settings, then Users + permissions, then Security roles, and select New role.",
+        "Name it {brand.microsoft.appName} agents, keep the root business unit and select Save.",
+        "For each privilege above, find its table (Account, Contact, Opportunity, Case, Activity, Note, User) and set that privilege's access level. Leave everything else at None and select Save."
+      ],
+      "copy": [
+        "# Needs the Azure CLI, signed in as a Dynamics 365 system administrator. Replace the address with your environment URL.",
+        "$environment = 'https://your-org.crm.dynamics.com'",
+        "$api = \"$environment/api/data/v9.2\"",
+        "$headers = @{ Authorization = \"Bearer $(az account get-access-token --resource $environment --query accessToken -o tsv)\"; 'Content-Type' = 'application/json' }",
+        "$root = (Invoke-RestMethod -Headers $headers \"$api/businessunits?`$filter=_parentbusinessunitid_value eq null&`$select=businessunitid\").value[0].businessunitid",
+        "$role = Invoke-RestMethod -Method Post -Headers ($headers + @{ Prefer = 'return=representation' }) \"$api/roles\" -Body (@{ name = '{brand.microsoft.appName} agents'; 'businessunitid@odata.bind' = \"/businessunits($root)\" } | ConvertTo-Json)",
+        "# Global is Organization access; use Local to keep agents to the business unit.",
+        "$names = @(",
+        "  '{scope}'",
+        ")",
+        "$privileges = foreach ($name in $names) { @{ PrivilegeId = (Invoke-RestMethod -Headers $headers \"$api/privileges?`$filter=name eq '$name'&`$select=privilegeid\").value[0].privilegeid; Depth = 'Global'; BusinessUnitId = $root } }",
+        "Invoke-RestMethod -Method Post -Headers $headers \"$api/roles($($role.roleid))/Microsoft.Dynamics.CRM.AddPrivilegesRole\" -Body (@{ Privileges = @($privileges) } | ConvertTo-Json -Depth 4)"
+      ],
+      "shell": "powershell"
+    },
+    {
+      "title": "Add the app as an application user",
+      "body": "Agents act as this application user. It needs no license, and the app needs no API permission in Microsoft Entra for this: what agents can reach is what the security role allows. Use the Application (client) ID {clientId}. With Commands, the application user goes to your own business unit.",
+      "click": [
+        "In the environment, select Settings, then Users + permissions, then Application users.",
+        "Select New app user, then Add an app, search for {clientId} and select Add.",
+        "Choose the business unit agents work in (the root one reaches every unit the role allows).",
+        "Under Security roles select the pencil, choose {brand.microsoft.appName} agents, then select Save and Create."
+      ],
+      "copy": [
+        "# Needs the Power Platform CLI (pac). Replace the address with your environment URL.",
+        "$environment = 'https://your-org.crm.dynamics.com'",
+        "pac auth create --environment $environment",
+        "pac admin assign-user --environment $environment --user '{clientId}' --role '{brand.microsoft.appName} agents' --application-user"
+      ],
+      "shell": "powershell"
+    },
+    {
+      "title": "Copy the environment URL",
+      "body": "The address of the environment agents will use, such as https://your-org.crm.dynamics.com. Enter it below.",
+      "click": [
+        "In the Power Platform admin center, go to Manage, then Environments, and open your environment.",
+        "Copy the Environment URL from its Details."
+      ],
+      "copy": ["pac admin list"],
+      "shell": "powershell"
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "environment",
+      "label": "Environment URL",
+      "help": "From the environment's Details in the Power Platform admin center.",
+      "placeholder": "https://your-org.crm.dynamics.com",
+      "secret": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read_customers",
+      "label": "Read accounts and contacts",
+      "description": "Find accounts and contacts and read their details.",
+      "scopes": ["prvReadAccount", "prvReadContact"],
+      "permissions": [],
+      "tools": ["dynamics_search_customers", "dynamics_get_customer"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    },
+    {
+      "id": "write_customers",
+      "label": "Create and update accounts and contacts",
+      "description": "Add accounts and contacts and change their details, such as phone numbers and addresses.",
+      "scopes": [
+        "prvReadAccount",
+        "prvCreateAccount",
+        "prvWriteAccount",
+        "prvAppendToAccount",
+        "prvReadContact",
+        "prvCreateContact",
+        "prvWriteContact",
+        "prvAppendContact"
+      ],
+      "permissions": [],
+      "tools": ["dynamics_create_customer", "dynamics_update_customer"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    },
+    {
+      "id": "read_opportunities",
+      "label": "Read opportunities",
+      "description": "Find opportunities and read their value, stage, close date and status.",
+      "scopes": ["prvReadOpportunity"],
+      "permissions": [],
+      "tools": ["dynamics_search_opportunities", "dynamics_get_opportunity"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    },
+    {
+      "id": "close_opportunities",
+      "label": "Close opportunities as won or lost",
+      "description": "Close open opportunities, with a reason and, for a win, the actual revenue.",
+      "scopes": ["prvReadOpportunity", "prvWriteOpportunity", "prvCreateActivity"],
+      "permissions": [],
+      "tools": ["dynamics_close_opportunity"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    },
+    {
+      "id": "read_cases",
+      "label": "Read cases",
+      "description": "Find customer service cases and read their status, priority and description.",
+      "scopes": ["prvReadIncident"],
+      "permissions": [],
+      "tools": ["dynamics_search_cases", "dynamics_get_case"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    },
+    {
+      "id": "close_cases",
+      "label": "Resolve and cancel cases",
+      "description": "Resolve cases with a resolution, or cancel them.",
+      "scopes": ["prvReadIncident", "prvWriteIncident", "prvCreateActivity"],
+      "permissions": [],
+      "tools": ["dynamics_close_case"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    },
+    {
+      "id": "read_activities",
+      "label": "Read activities and notes",
+      "description": "List the tasks, phone calls, emails, appointments and notes of the accounts, contacts, opportunities and cases an agent may use.",
+      "scopes": ["prvReadActivity", "prvReadNote"],
+      "permissions": [],
+      "tools": ["dynamics_list_activities"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}, and Read on the record's own table."
+    },
+    {
+      "id": "add_activities",
+      "label": "Add notes, tasks and phone calls",
+      "description": "Add notes, tasks and logged phone calls to the accounts, contacts, opportunities and cases an agent may use.",
+      "scopes": [
+        "prvCreateActivity",
+        "prvWriteActivity",
+        "prvAppendActivity",
+        "prvCreateNote",
+        "prvAppendNote"
+      ],
+      "permissions": [],
+      "tools": ["dynamics_add_activity"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}, plus Read and Append To on the record's own table."
+    },
+    {
+      "id": "read_tables",
+      "label": "Read other tables",
+      "description": "Read rows of the tables you list on each API key, such as products or your own tables, with simple conditions. Nothing is read from a table you do not list.",
+      "note": "Give the security role Read on each table you list.",
+      "scopes": [],
+      "permissions": [],
+      "tools": ["dynamics_list_rows", "dynamics_get_row"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs Read on this table."
+    },
+    {
+      "id": "delete",
+      "label": "Delete records",
+      "description": "Delete accounts, contacts, opportunities, cases, tasks, phone calls and notes. Dynamics also deletes what belongs to a record, such as its activities and notes. An agent kept to business units or teams can delete only tasks, phone calls and notes.",
+      "destructive": true,
+      "scopes": [
+        "prvDeleteAccount",
+        "prvDeleteContact",
+        "prvDeleteOpportunity",
+        "prvDeleteIncident",
+        "prvDeleteActivity",
+        "prvDeleteNote"
+      ],
+      "permissions": [],
+      "tools": ["dynamics_delete_record"],
+      "forbidden": "Dynamics 365 refused this. The agents' security role needs {scopes}."
+    }
+  ],
+  "limits": [
+    {
+      "id": "business_units",
+      "label": "Business units",
+      "help": "Optional: only records owned in these business units (their ids). To see them, open https://your-org.crm.dynamics.com/api/data/v9.2/businessunits?$select=name in your browser while signed in. With teams set too, a record of either is allowed. Leave both empty for every record the security role reaches.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+    },
+    {
+      "id": "teams",
+      "label": "Owning teams",
+      "help": "Optional: only records owned by these teams (their ids). To see them, open https://your-org.crm.dynamics.com/api/data/v9.2/teams?$select=name in your browser while signed in. Records this agent creates go to its team (name one when there are several).",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+    },
+    {
+      "id": "tables",
+      "label": "Other tables",
+      "help": "For Read other tables: the tables this key may read, by logical name, such as product or new_project (in Power Apps, under Tables, then the table's Properties). Under business units or teams, only tables whose records have an owner.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[a-z][a-z0-9_]{0,63}$"
+    }
+  ],
+  "verify": {
+    "label": "Security roles of the application user",
+    "check": "access",
+    "ifEmpty": "The application user has no security role yet. Give it the agents' role, then check again."
+  },
+  "revoke": "In the Power Platform admin center, open the environment's Application users and deactivate {brand.microsoft.appName}'s application user, or remove its security role. Agents lose access at once. To stop every Microsoft app at once, remove the app registration (see the Microsoft connection)."
+}

package/dist/connectors/dynamics-365/index.d.ts

@@ -0,0 +1,8 @@
+declare const _default: {
+    id: string;
+    create: ({ microsoft }: import("../microsoft/client.js").BuiltinContext) => {
+        vendor: import("../../packages/connector-kit/src/types.js").Vendor;
+        toolset: import("../../packages/connector-kit/src/common.js").Toolset;
+    };
+};
+export default _default;

package/dist/connectors/dynamics-365/index.js

@@ -0,0 +1,10 @@
+import { dynamicsTools } from "./tools.js";
+import { dynamicsVendor } from "./vendor.js";
+export default {
+    id: "dynamics-365",
+    create: ({ microsoft }) => ({
+        vendor: dynamicsVendor(microsoft),
+        toolset: dynamicsTools,
+    }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/dynamics-365/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/dynamics-365/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,eAAe;IACb,EAAE,EAAE,cAAc;IAClB,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC;QACjC,OAAO,EAAE,aAAa;KACvB,CAAC;CACqB,CAAC"}

package/dist/connectors/dynamics-365/tools.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { type Toolset } from "../../packages/connector-kit/src/common.js";
+type Row = Record<string, unknown>;
+type Scope = {
+    units: string[];
+    teams: string[];
+} | null;
+export declare function scopeFilter(scope: NonNullable<Scope>): string;
+export declare function inScope(scope: Scope, row: Row): boolean;
+/** One answer value as an OData literal: GUIDs, dates, numbers and booleans as they are, any
+ *  other text quoted. */
+export declare function literal(value: string | number | boolean): string;
+declare const filterSchema: z.ZodObject<{
+    column: z.ZodString;
+    op: z.ZodEnum<{
+        null: "null";
+        eq: "eq";
+        ne: "ne";
+        gt: "gt";
+        ge: "ge";
+        lt: "lt";
+        le: "le";
+        contains: "contains";
+        startswith: "startswith";
+        not_null: "not_null";
+    }>;
+    value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+}, z.core.$strip>;
+type Filter = z.infer<typeof filterSchema>;
+export declare function filterExpression(filters: Filter[]): string[];
+/** A row as agents get it: lookups as {id, name, table}, option sets and money as their
+ *  labels, text and dates as they are (long text shortened). */
+export declare function trimRow(row: Row, idColumn: string): Row;
+export declare const dynamicsTools: Toolset;
+export {};